High credibility, usually used for internal intelligence sources.

Low credibility, usually used for public intelligence sources.

Confirmed as malicious IP.

Medium credibility, usually used for private intelligence sources.

Normal IP.

Confirmed to be safe, usually used for whitelists.

Suspected of attack, IP addresses that require special attention.

Unknown risk level.

Threat Intelligence Record.